Vietnam's Circular 53 classes AI credit decisions of VND 50 million or more as high-risk

Implications for lenders

Lenders in Vietnam that use AI to propose loans of VND 50 million or more may need an impact assessment, board approval and logged human override before the model can run, which can lengthen model release cycles. Disputed automated rejections must go to a person and the key factors kept on file, so underwriting systems may need to record reasons at the time of each decision. Models bought from vendors stay the lender's responsibility, and contracts may need clauses that bar the vendor from training on the lender's data without written consent.

Implications

Facts

Rule: the State Bank of Vietnam (SBV) issued Circular 53/2026/TT-NHNN on safety, risk management and deployment conditions for artificial intelligence (AI) systems in banking on 30 September 2026, signed by Deputy Governor Pham Tien Dung. It takes effect on 15 November 2026; AI systems already in operation before then must meet its requirements by 1 March 2027. It covers AI that makes or supports decisions in customer-facing operations at credit institutions, foreign bank branches, payment intermediaries, e-money providers, credit information companies, the asset management companies of credit institutions and Vietnam Deposit Insurance.

Risk classes: every AI system must be classed as high, medium or low risk before deployment and recorded in an inventory reviewed at least once a year. A system that automatically proposes credit decisions is high-risk when the credit amount is VND 50 million or more ¹. Automated-payment systems are high-risk above VND 10 million per transaction or VND 20 million a day for an individual customer ², and above VND 50 million per transaction or VND 100 million a day for an institutional customer ³. High-risk systems need an impact assessment covering fairness, transparency, explainability and discrimination risk, and board approval before launch; high- and medium-risk systems are reported to the board at least every 6 months ⁴.

Payments and customers: payments executed automatically by AI require a prior agreement with the customer, setting the scope, per-transaction and daily limits, and the customer may suspend or end it at any time. The daily value may not exceed VND 100 million for an individual or VND 500 million for an institution ⁵. Customers must be told at the start of a session when they are dealing with AI rather than a person. Automated credit decisions must also follow the rules on electronic lending.

Accountability: AI does not replace human authority; institutions may not cite system autonomy or a third-party product to limit their responsibility. Staff must be able to override, pause or stop an AI system, with each intervention logged. A contested automated decision must be reviewed by a person, whose review is the final basis for handling the complaint, and institutions must keep the key factors behind decisions affecting obligations or access to products so they can explain them on request, without disclosing source code or trade secrets. Outsourced providers may not use an institution's data to train or improve models without written consent, and serious incidents are reported to the SBV.

Analysis

Across the region, Vietnam has chosen hard numbers where Thailand chose principles. The Bank of Thailand's AI risk-management guidelines for financial service providers, issued in September 2025 after a June 2025 consultation, ask for oversight calibrated to risk and impact, human oversight of decisions such as loan approvals, and disclosure to customers when they interact with AI, but set no amount thresholds. Vietnam's rule ties the high-risk class directly to loan size, so the line between a lightly governed and a fully governed scoring model is VND 50 million per credit.

Over time, the rule completes a sequence of SBV measures on digital lending. Earlier in October the SBV's sandbox had returned the 2 credit-scoring and Open API applications it handled ⁶, while banks had biometrically matched over over 174.5 million individual customer records ⁷. Identity checks were the first layer; Circular 53 now governs the decision layer, with explainability and human review as conditions rather than options.

Counterpoints and uncertainties

The circular sets later start dates for its risk-management framework and staffing requirements, so how strictly the SBV supervises during the transition is not yet known. Lenders could also respond by keeping AI below the high-risk amount or by reverting to rule-based scoring, which would limit the gain in credit accuracy. How the circular interacts with the electronic-lending rules and the national AI law will depend on further guidance.